Low dimensional bound entanglement with one-way distillable cryptographic key 



Karol Horodecki^, Lukasz Pankowski^ 2 ) , Michal Horodecki^ 3 ) , Pawel Horodecki^ 4 ) 
^Department of Mathematics Physics and Computer Science, University of Gdansk, 80-952 Gdansk, Poland 
( 2 > Institute of Theoretical Physics and Astrophysics University of Gdansk, 80-952 Gdansk, Poland 
^Institute of Theoretical Physics and Astrophysics University of Gdansk, 80-952 Gdansk, Poland and 
^Faculty of Applied Physics and Mathematics, Technical University of Gdansk, 80-952 Gdansk, Poland 



in 
o 
o 

C 

(N 



> : 

m . 
o ■ 

vo : 
o . 

in ■ 
o ■ 

^ : 

9 L,: 
^— > ■ 

G ■ 
cd 

3 : 
cr 



We provide a class of bound entangled states that have positive distillable secure key rate. The 
smallest state of this kind is 4 ® 4, which shows that peculiar security contained in bound entangled 
states does not need high dimensional systems. We show, that for these states a positive key rate can 
be obtained by one-way Devetak- Winter protocol. Subsequently the volume of bound entangled key- 
distillable states in arbitrary dimension is shown to be nonzero. We provide a scheme of verification 
of cryptographic quality of experimentally prepared state in terms of local observables. Proposed 
set of 7 collective settings is proven to be optimal in number of settings. 



Quantum cryptography is one of the very interesting 
practical phenomena within quantum information the- 
ory |H S EJ Q There were in general two ideas to pro- 
duce cryptographic key. The first was based on send- 
ing nonorthogonal states ||, the second - on specially 
chosen measurements of maximally entangled pairs [2J. 
They have been shown to be equivalent in general Q in- 
cluding most general eavesdropper attack. An important 
ingredient of the protocol was so called Quantum Pri- 
vacy Amplification [j| based on distillation of EPR paris 
0. Despite of natural expectations, that distillability 
of EPR pairs is a precondition of secure key it has been 
recently shown [lfj, |l]J that the class of states which con- 
tain ideal key {private states) is much wider than class 
of maximally entangled states. It has been shown that 
certain bound entangled (BE) states [l^ (from which no 
EPR pair can be distilled) can be distilled to (approxi- 
mate) private states. In other words - surprisingly - there 
are bound entangled states with Kr> > 0. 

However the BE states with nonzero distillable key 
Kr> > of Ref. 0, |n| require Hilbert space of quite 
large dimension, which makes impression that BE states 
useful for cryptography are rather exceptional, and far 
from experimental regime. In this paper we provide a 
general construction of class of BE states with Kd > 
and give examples of 4 (8 4 states having this property. 
To this end we consider binary mixture {pi,P2} of two 
orthogonal private bits (private states with at least one 
bit of ideal key). We first show that any such non equal 
mixture has Ko > 0, and can be distilled by - quite re- 
markably - one-way Devetak- Winter protocol [13| . Next 
we construct special pairs of private bits, and show that 
for certain probability their mixture is key distillable and 
bound entangled. To obtain this we assure that the state 
remains positive (and even invariant) under partial trans- 
position (PPT) |l4j which is sufficient condition for a 
state to be non distillable We then provide an ex- 
ample of the smallest state of our construction which 
resides on 4 qubits. Basing on this family of BE key dis- 
tillable states we argue, that the volume of BE states with 
Kd > is nonzero in arbitrary dimension. We exploit 



their properties, and consider their experimental prepa- 
ration. We then show how to verify that experimentally 
prepared state has nonzero distillable key. Finally the 
optimal decomposition of observables needed for veryfi- 
cation if certain 4 eg) 4 state has Kry > is given. 

Let us first recall that private bit [llj is a state 
lAA'BB', where AA' is hold by Alice, BB' by Bob, and 
measurement of AB in standard basis provides one bit of 
perfect key (ie. possible outcomes are either {00} or {11} 
with equal probability 1/2 and they are completely inde- 
pendent on measurements on physical system different 
than AA'BB'). Following [u| we will write 7 in matrix 
representation in ABA' B' order of subsystems, so that 
its 4 x 4 structure corresponds to two qubit subsystem 
AB. 

We shall start the construction of key distillable BE 
states by providing a class of states with Krj > 0: 

Proposition 1 .- Consider two private bits 71, 72 and 
take any biased mixture of the form: 
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with, say, p\ > P2 and — {o- x )a <8> Ia'BB' ■ The distill- 
able key K]j(p) fulfills Ko{p) > 1 — h(p\) where h(pi) is 
the binary entropy of distribution {pi,P2}- 

Before we prove the proposition, we have to recall a 
technique called "privacy squeezing" [llj that allows to 
investigate privacy of states of type paa'bb 1 - The state 
is purified to if) aba 1 b> e so that Eve holds the subsystem 
E of ifi. To draw key, Alice and Bob will measure systems 
AB in standard basis, and will process the outcomes by 
public discussion. The systems A'B' will not be actively 
used, so the relevant state is 



(ccq) 

Pabe 



Pij\ij){ij\AB® P ( e ] 



(2) 



where p 1 ^ are Eve's states given the outcome was if. The 
state is called ccq (two re giste rs are classical). From such 
state by Devetak- Winter [13| protocol one can get 



K DW = I (A : B) - I(A : E) 



(3) 
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bits of key where I (A : B) p = S{A) + S(B) - S(AB), 
S(X) being von Neumann entropy of X subsystem of 
state p. We will now provide a different ccq state cr^j^, 
which is no better, in the sense that Eve can obtain it 
from Pa'be by some operation on her system. Clearly, 
such a( ccq ' can give no more key than p( ccq \ The state 
we produce as follows. First, from paa'BB' we 
obtain its privacy squeezed (p-squeezed) version a ab ■ To 
this end {%) we apply so-called twisting |10L i.e. a 
unitary transformation controlled by standard basis on 
AB U T = J^ij \ij)(ij\AB ® Ua'B' an d subsequently (ii) 
we trace over systems A'B' . One finds |l0|, [llj that p- 
squeezed state gab has a property that the ccq state 
ct'a'be emerging after measuring it in standard basis \ij) 
is no better than Pabe- However, if twisting is properly 
chosen, then it may still produce much key. The privacy 
is now squeezed to solely two systems AB. 

Proof of Proposition. Using the above method, we 
will apply p-squeezing to the state p, and show that from 
the the DW protocol give s 1 — h(pi) rate of key. A 

basic fact about private bits [lOj is that there exists twist- 
ing which brings them to the form ipQ B <g> pa'B 1 where 
PA' B' is some state, i/jq is one of four Bell states 



bit can be represented in its X-form [TH ]: 



lABA'B' = 
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where X is arbitrary operator with trace norm one, and 
which completely represents the pbit. Then, we obtain 
that state p is of the form 



P= 2 
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We assume now that A' and B' are systems both de- 
scribed by C d . Now the essential part of the construction 



is the following substitution: X\ — 



\\Wu\\ 



Wu where 



W v =^2u i:j \ij)(ji\ 



(10) 
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\i> ,i) = ^=(|00> ± |11)) 

hM = ^(|oi)±|oi» 



(4) 
(5) 



and in the twisting Uqi = U±q = I . Using this, we im- 
mediately obtain a twisting which, followed by partial 
trace over A'B', turns the state p of eq. (Q) into a mix- 
ture of Vo an d i>2 ■ he. the p-squeezed state of Q is 
cab = Pi|V'o)(^ol +P2|V ; 2)(V'2|- Its purification is of the 
form 



ABE 



Pl\i>a) AB\e-l) E + \JP2\^2) Ab\&2) E (6) 



so that by measuring it in standard basis Alice and Bob 
obtain the ccq state 



T (ccg) 

ABE 
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[POI + Pio] ® Pe, (7) 



with Pij — 



an d P ei — I e i ) { e -s j ■ F° r this state, 
we have I(A : B) — I {A : E) = 1 — h( Pl ) Thus by DW 
protocol [l3| we get this amount of key. Because this 
state is no better than our state of interest P^abe (* ne 
ccq state obtained by measuring AB systems of initial 
state p) we obtain that the distillable key of p satisfies 
Kd{p) > 1 — h(pi), which ends the proof of proposition. 

Let us note that the key is here drawn by one-way pro- 
tocol. We have found that applying two-way recurrence 
protocol will not increase the key rate. 

Construction of small dimensional bound entangled 
states with Kd > First let us recall, that any private 



and Uij are unitary matrix elements of some matrix U on 



C d . Note that \\Wu\\ = £ 



(here we use the trace 
The second operator we choose 



ij l"u 



norm of the matrix). 
X2 = j j w r j j with r being partial transposition on sub- 
system B' . In this case one has just ||W^|| = d 



The corresponding mixing probabilities are 
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respectively. 

Collecting two simple observations, namely that: (i) 
[WuW^i = [wlWu]i = EijKmm (which af- 
tcr normalisation by factor ||W(t|| gives separable, PPT- 
invariant state), (ii) [FUc/lU^]^ = [VF^lUc/]^ = £, \H){n\, 
(again after normalisation giving PPT-invariant separa- 
ble state) We get immediately that p with parameters 
defined like above is PPT invariant. At the same time 
we have desired security condition p\ > p 2 if only 



Pi 
Pi 



1^1 



> 1. 



(12) 



The latter is satisfied for any unitary U which written in 
{|ij)} basis has more than d nonzero entries. 

Thus we have a large class of states that contain secure 
key and are at the some time PPT invariant states. Of 
course they are entangled since entanglement is a precon- 
dition of secure key distillation [l^ . 

Observation 1 The ratio of p\ and pi in which 
is related to K DW key rate achieves the highest value 
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for unimodular unitaries U (ie such that |wj 



1 

irrespectively of indices {i,j}). Then it amounts to 

[^]optimal yd. 

Indeed, by use of Lagrange multipliers with slightly 
more general constraints \ u ij\ 2 — d we S e t that opti- 
mal U is unimodular. 

Example of small bound entangled states with Km > 
on 4 <g> 4 system. Putting d — 2 we get the smallest 
secure BE states in our construction. An easy example 
is a state with U equal to 1-qubit Hadamard gate (H). 
Note, that in this case, the state 72 coincides with the 
so called "flower state" with U = H, which exhibited 
locking of entanglement cost 0|. The total state can 
be written as a mixture of Bell states on AB subsystem 
of state, that are classically correlated with some other 
states on A'B' . Namely we have 

Ph = ^2qi\i>i)(ipi\AB ®P { a>b' 

i 

where the correlated states are the following: 



(13) 



n(°) - 



[P0O + PV2] 



= 2^ 



,(2,3) 



X± 



(14) 



with P t j )i being projectors onto corresponding Bell states 
and P x± projectors onto pure states 



X ± = ~(\/2±V2 |00) ± y2 =p \/2 |11)) (15) 
respectively. The mixing distribution {<7i}f =0 is 



tpi 
t 2 ' 



Pl P2 P2 



}. Since d — 2, one has pi 



V2 



by proposition a positive key rate can be gained from 
this 4-qubit PPT state. It reads: 

Kd W {ph) = 1 - h(pi) = 0.0213399 (16) 

per copy of pn- Note again, that it automatically means, 
that ph is bound entangled. Indeed we have shown, that 
state of that construction is PPT invariant, and it can 
not be separable, as it has non-zero distillablc key. We 
show now the next property of this state. 

Observation 2 The state pn is extremal in the set of 
PPT states. 

Ph is a mixture of form @ with X\ — Wh and X2 
Y It is straightforward to check, that any mixture with 
the weight of 71 different then value pi = -^j^ leads to 
NPT state. In fact the same argument proves extremity 
of the state from our construction with X = Wjj, if only 
X is hermitian operator, and either X or X r has some 
positive eigenvalue. 

Although the states pu lay on the edge of the set of 
PPT states, basing on this family of states we are able 
to show, that the set of PPT key distillable states has 
non-zero volume in the set of all PPT 4 £g) 4 states . 



Observation 3 The set of PPT distillable key of the 
form pu has nonzero volume in 4 ® 4. 

The proof of this observation bases on the fact, that 
Devetak- Winter lower bound © is continuous in p, as 
mutual information is continuous function of p. If we 
consider now p m i X p + (1 — Pmix)jg> for suitably small 
Pmix there exists suitably small e > for which the ball 
of all states with the center at pu and radius e lays within 
the set of PPT states. By continuity argument, one gets 
the thesis. In fact a similar argument gives this result in 
any dimension higher than 4 eg) 4. 

Upper bound for Krj.- Similarly as private bit is ana- 
logue of singlet from entanglement distillation theory, the 
state p of 0} is analogue of mixture of two singlets (which 
is actually just the p-squeezed state a). The distillablc 
entanglement of the latter state is just 1 — h(pi), 
and moreover it is achieved, by coherent application of 
the DW protocol. Therefore there is a question, if Kr>{p) 
is just equal to 1 — h{pi). In 0, ^| we show that rel- 
ative entropy of entanglement E r is an upper bound for 
Kd- We have analysed the 4® 4 PPT state pn, and have 
found a separable state which gives E r (pn) < 0.116. 

Preparation of pu 4 4 states.- As it is shown in ex- 
ample fT3|) pu 4 (g) 4 states are only classically correlated 
along AB versus A'B' cut. Thus they can be created by 
preparing randomly according to {qi} distribution, sepa- 
rately two states: a Bell state tpi (for AB subsystem) and 
pM (f or A'B' subsystem). According to observation© 
pu lays on the boundary of PPT set, any small pertur- 
bation can destroy this property. However in spirit of 
observation one can construct PPT states that are 
to some extent robust against perturbations. 

Key distillability verification for experimentally pre- 
pared state.- We now address the question of verifica- 
tion whether a state prepared experimentally in many 
copies has nonzero distillable key. In the spirit of proof of 
the proposition Q instead of estimating whole paba'B' 
we suggest to estimate only few parameters of its pri- 
vacy squeezed state gab and subsequently compute some 
lower bound on the value of DW rate © for the ccq state 
a ABE °f the latter. 

Once we do not estimate whole state Paba'B' , the for- 
mula © can not be used directly to decide its quality. 
Instead we first consider a lower bound for distillable key 
from ccq state. Namely 



K D {p^) > I (A : B), 



S{E), 



(17) 



which is a consequence of formula Indeed, I (A : 

E) for ccq state is equal to S(pe) — J2iPiS(PE)> which 
is Holevo function of ansamble {pi,p^}. This however 
can not be greater then just entropy of Eve's subsystem 
S(pe) and the assertion follows. 

Using this lower bound we provide now the one which 
is a function of only diagonal and antidiagonal matrix 
elements of (2-qubit) privacy squeezed state (tab- Note, 
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that S(oe) = S{&ab), as the total ABE state is pure. 
To estimate S{oe) we will consider state o ab subjected 
to twirling 9] which projects onto Bell basis. Twirling 
can not decrease the entropy, and commutes with mea- 
surement in computational basis, so one has that 

K D {a^ E ) > I(A : B) - S(o%? 1 ) (i 8 ) 

This is desired lower bound as it is a function of only 
those parameters, which we suggest to estimate experi- 
mentally. 

Although the formula IjlSjl is useful for one-way key 
distillable states, knowing the diagonal and antidiagonal 
elements of gab is enough to decide if a two-way recur- 
rence protocol can make key rate non-zero. 

We give now the observables, which measured on 
Paba 1 b' reveals desired elements of its p-squeezed state. 
These are: 

Oi = U\\o z ® o z ]ab <8> Ia>b>U t 

R1.2 = Ul[Pip 2 - P^ 13 ]ab <8> Ia>b>U t 

h,2 = Ur[Pil>a,2 ~ Pipi^AB ® Ia'B'U t 

(19) 

where P^, k are Bell states with relative phase ±i. The 
observable 0\ reveals the diagonal elements of state <tab- 
In fact, it is just equal to [o z ® <t z ]ab <H> Ia'B< as any 
twisting (here commutes with the measurement in 
basis which it controls 0\ needs therefore just one 
setting. The Rk (Ik) observables reveals real (imaginary) 
parts of (possibly complex) coherences on antidiagonal of 
gab- Indeed, one has for example 

TrRiPABA'B' = 

Tr\j\[P i>a - P^\AB ® lA'B'U T pABA'B' = 

Tr[P^, Q - P^Aab <g Ia'B'U t paba'b>uI = 

Tr [ P i>o - P i>i\ Tr 'A' B<[U T PABA> B'U\] = 

Tr[P^ - P^}<tab- (20) 

where second equality is by property of trace, and third 
by definition of subsystem of a quantum state. Last 
equality uses definition of privacy squeezed state (oab) 
which is obtained by acting on paba 1 b> with some twist- 
ing U T and tracing out A'B' subsystem. 

Local decomposition of verification observables for pn- 
In case of pn twisting which realises privacy squeezing is 
equal to: 

U T = |00)(00|(g)W r H +|01)(01|(8)P ff +(|10)(10| + |ll>(ll|)®/ 

(21) 

where by P H = J2ij=o h ij\ U ){n\ + Ei/j KiX^'l for h ij 
elements of Hadamard and Wh = Pjj- For this U T) the 
observables Ri and 1\ can be decomposed into Pauli op- 
erators {7, o x , o~ v , o z } in the following way: 

R\ = - [o x ® o x - o y <g> o v ]ab ® 



^ [(I ®0 Z +0 Z ®I) + (0 X ®0 X +Oy® Oy)] A 'B' 
1. 

Il = ® O-y + Oy (g> o x \ab <8> 

<g [(7 (g) o z + o z <g 7) + (dz ® (7 X + <7 y <g> o- v )]a'B' 
and the same for 7? 2 and 7 2 , which read 

R2 = 1 [cr K (g (Tj; + CTy (g (TjIab (g [(/ (g / - cr z (g (T z ) + 

-7= ((I <g CT Z + <7 Z <g 7) + (cr K (g (7 X + (Ty (g cr y ))]A'S' 

V 2 

7 2 = -tI^j, Ig CTj; - O x (g £7 v ]aB <g [{I <g / - cr 2 (g (7 Z ) + 

-7= ((7(g) CT Z + O z (g 7) + ((Tz (g <T X + cr y (g cr y ))]A'B' 

V 2 

Generalizing approach for two-qubit case of HHIi to 
four qubit case, one can easily show, that decomposition 
for 7?2 and 7 2 is optimal in the sense, that it needs 6 
settings. The set of these 6 collective settings is enough 
for both 7?2 , 7 2 and R\ , I\ (for the latter it needs only 
different classical post-processing). Since this set of set- 
tings is optimal for determining 7? 2 ,7 2 and suffices for 
determining all Ri,Ii, we conclude, that it is optimal for 
our task. Together with one setting for 0\ one needs 7 
different collective settings to verify via lower bound l|18|) 
if the state pn has non zero distillable key. 



We thank Ryszard Horodecki for helpful comments 
and remarks. KH, MH and PH acknowledge the hos- 
pitality of Isaac Newton Institute for Mathematical Sci- 
ences during the QIS programme. The work is supported 
by Polish Ministry of Scientific Research and Informa- 
tion Technology under the (solicited) grant no. PBZ- 
MIN-008/P03/2003 and by EC grants RESQ, contract 
no. IST-2001-37559 and QUPRODIS, contract no. IST- 
2001-38877. 



[1] D. Bouwmeester, A. K. Ekert, and A. Zeilinger, The 
physics of quantum information : quantum cryptography, 
quantum teleportation, quantum computation (Springer, 
New York, 2000). 

[2] M. A. Nielsen and I. L. Chuang, Quantum Computa- 
tion and Quantum Information (Cambridge University 
Press,Cambridge, 2000). 

[3] G. Alber, T. Beth, M. Horodecki, P. Horodecki, 
R. Horodecki, M. Rotteler, H. Weinfurter, R. Werner, 
and A. Zeilinger, Quantum Information: An Intro- 
duction to Basic Theoretical Concepts and Experiments 
(Springer, 2001). 

[4] J. Gruska, Quantum Computing (McGraw-Hill, London, 
1999). 

[5] C. H. Bennett and G. Brassard, in Proceedings of the 
IEEE International Conference on Computers, Systems 



■5 



and Signal Processing (IEEE Computer Society Press, 
New York, Bangalore, India, December 1984, 1984), pp. 
175-179. 

[6] A. Ekert, Phys. Rev. Lett 67, 661 (1991). 

[7] P. W. Shor and J. Preskill, Phys. Rev. Lett 85, 441 

(2000), quant-ph/0003004. 
[8] D. Deutsch, A. Ekert, R. Jozsa, C. Macchiavello, 

S. Popescu, and A. Sanpera, Phys. Rev. Lett 77, 2818 

(1996) , quant-ph/9604039. 

[9] C. H. Bennett, G. Brassard, S. Popescu, B. Schumacher, 
J. Smolin, and W. K. Wootters, Phys. Rev. Lett 78, 2031 

(1997) , quant-ph/95 11027. 

[10] K. Horodecki, M. Horodecki, P. Horodecki, and J. Op- 
penheim, Phys. Rev. Lett 94, 160502 (2005), quant- 
ph/0309110. 

[11] K. Horodecki, M. Horodecki, P. Horodecki, and J. Op- 
penheim, quant-ph/0506189. 



[12] M. Horodecki, P. Horodecki, and R. Horodecki, Phys. 

Rev. Lett 80, 5239 (1998), quant-ph/9801069. 
[13] I. Devetak and A. Winter (2003), quant-ph/0306078. 
[14] A. Peres, Phys. Rev. Lett. 77, 1413 (1996). 
[15] M. Curty, M. Lewenstein, and N. Liitkenhaus, Phys. Rev. 

Lett 92, 217903 (2004), quant-ph/0307151. 
[16] K. Horodecki, M. Horodecki, P. Horodecki, and J. Op- 

penheim, Phys. Rev. Lett 94, 200501 (2005). 
[17] C. H. Bennett, D. P. DiVincenzo, J. Smolin, and 

W. K. Wootters, Phys. Rev. A 54, 3824 (1997), quant- 

ph/9604024. 

[18] O. Guehne, P. Hyllus, D. Brass, A. Ekert, M. Lewenstein, 
C. Macchiavello, and A. Sanpera, JMO 50 (6-7), 1079 
(2003), quant-ph/0210134. 

[19] O. Guehne and P. Hyllus, Int. J.Theor.Phys. 42, 1001 
(2003), quant-ph/0301162. 



